Hi so our security team said that we need to hide the Allow header
Is the request possible?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
... our security team said that we need to hide the Allow header
Either they've told you something wrong or you understood it wrong.
Allow is actually a mandatory header when doing response code 405. From RFC 7231 section 6.5.5:
405 Method Not Allowed
The 405 (Method Not Allowed) status code indicates that the method received in the request-line is known by the origin server but not supported by the target resource. The origin server MUST generate an Allow header field in a 405 response containing a list of the target resource's currently supported methods.
What I find a more likely requirement given the picture you show is that the server should not support the TRACE method in the first place and therefore also should not show TRACE as supported.